CDPSvc Privilege Escalation

The vulnerability of the CDPSvc service for connected user devices in the Windows operating system is related to object handling errors in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Windows GDI Information Disclosure

The vulnerability of the Windows GDI component of the Windows operating system is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially crafted application...

Windows Cryptography Next Generation Disclosure

The vulnerability of the Windows Cryptography Next Generation CNG service on Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

Huawei USG6330 DoS

The vulnerability of the Huawei USG6330 network firewall is related to errors in processing network packets. Exploiting this vulnerability can allow a remote attacker to exhaust the available memory and cause the device to reboot...

XSS vulnerability in Subversion Release Manager

Subversion Release Manager 1.2 and earlier does not escape the error message for the Repository URL field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure...

CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

Format string

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

CVE-2020-10101

CVE-2020-10101 affects Zammad 3.0–3.2 where the WebSocket server crashes when non‑JSON messages are sent. The root cause is inadequate validation of message format and unhandled parsing errors, causing a service process crash. Public details in the connected sources reiterate the same description...

CVE-2020-10101

An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process...

SynTP.sys Driver Unauthorized Access

The vulnerability of the SynTP.sys driver for Synaptics Touchpads is related to errors in handling API requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Intel NVMe Intel RSTe Privilege Escalation

The vulnerability of Intel NVMe and Intel RSTe driver installers is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Keycloak STARTTLS Privilege Escalation

The vulnerability of the STARTTLS component of the Keycloak identity and access management software is related to implementation errors in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

Keycloak Privilege Escalation

The vulnerability of the Keycloak identity and access management software is related to errors in the implementation of authentication procedures. Exploiting this vulnerability can allow unauthorized actors to gain increased privileges...

SAP NetWeaver Keystore Disclosure

The vulnerability of the SAP NetWeaver software integration platform’s keystore service is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

SharePoint Workflows XOML Injection

This module exploits a vulnerability within SharePoint and its .NET backend that allows an attacker to execute commands using specially crafted XOML data sent to SharePoint via the Workflows functionality. Module Options msf use exploit/windows/http/sharepoint/workflowsxoml msf...

OPENSUSE-SU-2020:0261-1 Security update for python-azure-agent

This update for python-azure-agent fixes the following issues: python-azure-agent was updated to version 2.2.45 jscECO-80 + Add support for Gen2 VM resource disks + Use alternate systemd detection + Fix /proc/net/route requirement that causes errors on FreeBSD + Add cloud-init auto-detect to...

Kr00k WiFi Vulnerability

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a...

Windows COM Server Privilege Escalation

The vulnerability of the Windows COM Server component of the operating system is related to errors in the processing of COM objects. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

Samba Access Control Error

The vulnerability of Samba software is related to errors in access control. Exploiting this vulnerability can allow a perpetrator to compromise data integrity and cause service failures...